The Road to Zero CVEs: People and Technology
summary
Claims that "zero CVEs" is a destination are false; it’s a continuous journey that combines people, process, and tooling. Practical steps shown include signing artifacts with Sigstore, end‑to‑end attestations with in-toto, ingesting SBOMs and VEX into GUAC, and adopting SLSA/S2C2F patterns. Examples: inventorying with osquery, blocking unverified packages via artifact proxies and OPA/Kerno policies, and treating Log4Shell–style incidents as known‑asset lookups. The concrete outcome: fewer unknowns, faster remediation, and measurable reduction in exposure across environments that follow these practices.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:22Defining CVEs and threats
- 3:10Government regulations
- 5:40Zero CVEs realistic?
- 8:12Vulnerability management challenges
- 10:00Zero CVEs vs security
- 12:07Guardrails for supply chains
- 16:01Trusting software sources
- 17:27Software inventory updates
- 19:17Consistent security policies
- 22:50People in secure development
- 25:18Steps toward zero CVEs
- 28:25Key takeaways
- 31:18Q&A
related talks
32mSponsored Session: A New Security Standard for the AI Era: Zero-CVE and Real-Time Threat…
35mKeynote: How I learned to stop worrying and love CVEs
29mThe Quality Era of CVE: A Blueprint for Global Software Safety
48m5 Steps to VEX Success: Managing the End-to-End Workflow
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
39mSoftware Security Engineering (Learnings from the past to fix ...)
42mImplementing Zero Trust in Government Settings: Strategies, Challenges, and Best Pra...
39mCVE 101: The Unfolding Of A Zero Day Attack